OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 // This file includes code SSLClientSocketNSS::DoVerifyCertComplete() derived | 5 // This file includes code SSLClientSocketNSS::DoVerifyCertComplete() derived |
6 // from AuthCertificateCallback() in | 6 // from AuthCertificateCallback() in |
7 // mozilla/security/manager/ssl/src/nsNSSCallbacks.cpp. | 7 // mozilla/security/manager/ssl/src/nsNSSCallbacks.cpp. |
8 | 8 |
9 /* ***** BEGIN LICENSE BLOCK ***** | 9 /* ***** BEGIN LICENSE BLOCK ***** |
10 * Version: MPL 1.1/GPL 2.0/LGPL 2.1 | 10 * Version: MPL 1.1/GPL 2.0/LGPL 2.1 |
(...skipping 3109 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
3120 // Note that this is a completely synchronous operation: The CT Log Verifier | 3120 // Note that this is a completely synchronous operation: The CT Log Verifier |
3121 // gets all the data it needs for SCT verification and does not do any | 3121 // gets all the data it needs for SCT verification and does not do any |
3122 // external communication. | 3122 // external communication. |
3123 cert_transparency_verifier_->Verify( | 3123 cert_transparency_verifier_->Verify( |
3124 server_cert_verify_result_.verified_cert.get(), | 3124 server_cert_verify_result_.verified_cert.get(), |
3125 core_->state().stapled_ocsp_response, | 3125 core_->state().stapled_ocsp_response, |
3126 core_->state().sct_list_from_tls_extension, &ct_verify_result_, net_log_); | 3126 core_->state().sct_list_from_tls_extension, &ct_verify_result_, net_log_); |
3127 // TODO(ekasper): wipe stapled_ocsp_response and sct_list_from_tls_extension | 3127 // TODO(ekasper): wipe stapled_ocsp_response and sct_list_from_tls_extension |
3128 // from the state after verification is complete, to conserve memory. | 3128 // from the state after verification is complete, to conserve memory. |
3129 | 3129 |
3130 if (!policy_enforcer_) { | 3130 if (policy_enforcer_ && |
3131 server_cert_verify_result_.cert_status &= ~CERT_STATUS_IS_EV; | 3131 (server_cert_verify_result_.cert_status & CERT_STATUS_IS_EV)) { |
3132 } else { | 3132 scoped_refptr<ct::EVCertsWhitelist> ev_whitelist = |
3133 if (server_cert_verify_result_.cert_status & CERT_STATUS_IS_EV) { | 3133 SSLConfigService::GetEVCertsWhitelist(); |
3134 scoped_refptr<ct::EVCertsWhitelist> ev_whitelist = | 3134 if (!policy_enforcer_->DoesConformToCTEVPolicy( |
3135 SSLConfigService::GetEVCertsWhitelist(); | 3135 server_cert_verify_result_.verified_cert.get(), ev_whitelist.get(), |
3136 if (!policy_enforcer_->DoesConformToCTEVPolicy( | 3136 ct_verify_result_, net_log_)) { |
3137 server_cert_verify_result_.verified_cert.get(), | 3137 // TODO(eranm): Log via the BoundNetLog, see crbug.com/437766 |
3138 ev_whitelist.get(), ct_verify_result_, net_log_)) { | 3138 VLOG(1) << "EV certificate for " |
3139 // TODO(eranm): Log via the BoundNetLog, see crbug.com/437766 | 3139 << server_cert_verify_result_.verified_cert->subject() |
3140 VLOG(1) << "EV certificate for " | 3140 .GetDisplayName() |
3141 << server_cert_verify_result_.verified_cert->subject() | 3141 << " does not conform to CT policy, removing EV status."; |
3142 .GetDisplayName() | 3142 server_cert_verify_result_.cert_status &= ~CERT_STATUS_IS_EV; |
3143 << " does not conform to CT policy, removing EV status."; | |
3144 server_cert_verify_result_.cert_status &= ~CERT_STATUS_IS_EV; | |
3145 } | |
3146 } | 3143 } |
3147 } | 3144 } |
3148 } | 3145 } |
3149 | 3146 |
3150 void SSLClientSocketNSS::EnsureThreadIdAssigned() const { | 3147 void SSLClientSocketNSS::EnsureThreadIdAssigned() const { |
3151 base::AutoLock auto_lock(lock_); | 3148 base::AutoLock auto_lock(lock_); |
3152 if (valid_thread_id_ != base::kInvalidThreadId) | 3149 if (valid_thread_id_ != base::kInvalidThreadId) |
3153 return; | 3150 return; |
3154 valid_thread_id_ = base::PlatformThread::CurrentId(); | 3151 valid_thread_id_ = base::PlatformThread::CurrentId(); |
3155 } | 3152 } |
(...skipping 30 matching lines...) Expand all Loading... |
3186 return channel_id_service_; | 3183 return channel_id_service_; |
3187 } | 3184 } |
3188 | 3185 |
3189 SSLFailureState SSLClientSocketNSS::GetSSLFailureState() const { | 3186 SSLFailureState SSLClientSocketNSS::GetSSLFailureState() const { |
3190 if (completed_handshake_) | 3187 if (completed_handshake_) |
3191 return SSL_FAILURE_NONE; | 3188 return SSL_FAILURE_NONE; |
3192 return SSL_FAILURE_UNKNOWN; | 3189 return SSL_FAILURE_UNKNOWN; |
3193 } | 3190 } |
3194 | 3191 |
3195 } // namespace net | 3192 } // namespace net |
OLD | NEW |